From 2c50516d51a883e46afb70f65658794eb67bd0b6 Mon Sep 17 00:00:00 2001 From: Phil Kuang Date: Tue, 9 Apr 2024 17:48:36 -0400 Subject: [PATCH] fix(cookieAuth): prefer issuing cookies against target host instead of origin Signed-off-by: Phil Kuang --- .changeset/curly-bottles-complain.md | 5 +++++ .../implementations/httpAuth/httpAuthServiceFactory.ts | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 .changeset/curly-bottles-complain.md diff --git a/.changeset/curly-bottles-complain.md b/.changeset/curly-bottles-complain.md new file mode 100644 index 0000000000..c83a3921e2 --- /dev/null +++ b/.changeset/curly-bottles-complain.md @@ -0,0 +1,5 @@ +--- +'@backstage/backend-app-api': patch +--- + +Fix auth cookie issuance for split backend deployments by preferring to set it against the request target host instead of origin diff --git a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts index fe927eaa5d..d6f5ceefa8 100644 --- a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts +++ b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts @@ -232,7 +232,7 @@ class DefaultHttpAuthService implements HttpAuthService { const externalBaseUrlStr = await this.#discovery.getExternalBaseUrl( this.#pluginId, ); - const externalBaseUrl = new URL(origin ?? externalBaseUrlStr); + const externalBaseUrl = new URL(externalBaseUrlStr ?? origin); const secure = externalBaseUrl.protocol === 'https:' ||